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(c) if said data packet is said computer network-based 
telephone session packet, filtering at least data in said 
data packet to determine if said data includes computer 
network-based telephone session data; 

(d) if said data includes computer network-based tele- 5 
phone session data, analyzing said computer network- 
based telephone session data; and 

(e) storing said computer network-based telephone session 
packet to form a stored packet according to said type, 
such that said stored data packet forms at least a portion 10 
of the computer network-based telephone session. 

11. The method of claim 10, wherein said data packet has 
a header and the step of analyzing said data packet in step 
(d) further comprises the step of: 

(i) filtering said header of said data packet to retrieve 
header data related to the computer network-based 
telephone session. 

12. The method of claim 11, wherein substep (i) of step 
(d) further comprises the step of: 20 

(1) analyzing said header data to determine if said data 
packet is an IP packet. 

13. The method of claim 12, wherein the step of analyzing 
said header data in substep (1) further comprises the steps of: 

(i) examining said header of said IP packet to determine 25 
an IP address of said packet source; 

(ii) determining if said IP address is a recorded IP address; 

(iii) passing said IP packet to form a passed IP packet 
substantially only if said IP address is said recorded IP 
address; and 

(iv) alternatively, dumping said IP packet. 

14. The method of claim 13, wherein the step of deter- 
mining if said IP address is said recorded IP address is 
performed by comparing said IP address to a list of IP 35 
addresses from packet sources, such that if said IP address 

is included in said list, said IP address is said recorded IP 
address. 

15. The method of claim 13, wherein step (d) further 
comprises the steps of: 40 

(ii) analyzing said IP packet to determine whether said 
passed IP packet is an H.225 packet, a H.245 packet, an 
RTP packet or an RTCP packet; 

(iii) if said type of said passed IP packet is said H.225 
packet, determining whether said H.225 packet is a 45 
setup packet or a connect packet; 

(iv) if said H.225 packet is said setup packet, setting a 
status flag as "start session request"; 

(v) alternatively, if said H.225 packet is said connect 
packet and said status flag is "start session request", 
storing at least one detail of the computer network- 
based telephone session; and 

(vi) setting said status flag as "wait for logic channel". 

16. The method of claim 15, wherein step (d) further 55 
comprises the steps of: 

(vii) alternatively, if said type of said passed IP packet is 
said H.245 packet, determining whether H.245 packet 
is an open logical channel request packet, an open 
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logical channel acknowledgment packet or a terminal 
capability set packet; 
(viii) if said H.245 packet is said open logical channel 
request packet and said status flag is "wait for logic 
channel", setting said status flag as "wait for acknowl- 
edgment"; 

(xi) alternatively, if said H.245 packet is said open logical 
chanel acknowledgment packet and said status flag is 
"wait for acknowledgment", performing the steps of: 

(A) setting said status flag as "wait for terminal capa- 
bility"; and 

(B) saving a transport address of the destination of the 
communication session; and 

(xii) also alternatively, if said H.245 packet is said ter- 
minal capability set packet, performing the steps of: 

(A) storing a capability of the packet destination from 
said terminal capability packet; and 

(B) setting said status flag as "in call progress". 

17. The method of claim 16, wherein if said status flag is 
"in call process" and said type of said passed IP packet is 
said RTP packet, storing said RTP packet. 

18. The method of claim 16, wherein if said status flag is 
"in call process" and said type of said passed IP packet is 
said RTCP packet, storing said RTCP packet. 

19. The method of claim 10, further comprising the steps 

of: 

(f) retrieving said stored data packet to form a retrieved 
data packet; and 

(g) reconstructing at least a portion of the computer 
network-based telephone session according to said 
retrieved data packet. 

20. The method of claim 19, wherein the step of retrieving 
said data packet of step (f) includes the steps of: 

(i) retrieving a source IP address of the packet source, a 
start time of the network-based telephone session, and 
an end time of the computer network-based telephone 
session; and 

(ii) selecting at least one computer network-based tele- 
phone session according to said source IP address, said 
start time and said end time. 

21. The method of claim 19, wherein the step of recon- 
structing at least a portion of the computer network-based 
telephone session of step (g) includes displaying audio data. 

22. The method of claim 19, wherein the step of recon- 
structing at least a portion of the computer network-based 
telephone session of step (g) includes displaying video data. 

23. The method of claim 19, wherein the step of recon- 
structing at least a portion of the computer network-based 
telephone session of step (g) further comprises the steps of: 

(i) receiving substantially only RTP packets; 

(ii) examninng a header of said RTP packets to determine 
a time stamp for each of said RTP packets; and 

(iii) displaying said RTP packets in order according to 
said time stamp. 

***** 
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RAS Signaling Channel is opened between the endpoint and 
the Gatekeeper. The RAS Signaling Channel is opened prior 
to the establishment of any other channels between H.323 
endpoints. 

FIG. 7 shows a second embodiment of the system of the 5 
present invention as a zone configuration system 116. A zone 
118 is the collection of all terminals (Tx) 108, gateways 
(GW) 110, and Multipoint Control Units (MCU) 112 man- 
aged by a single gatekeeper (GK) 114. Zone 118 includes at 
least one terminal 108, but does not necessarily include one 10 
or more gateways 110 or MCUs 112. Zone 118 has only one 
gatekeeper 114 as shown. However, in the preferred embodi- 
ment shown, zone 118 is preferably independent of LAN 
topology and preferably includes multiple LAN segments 
120 which are connected using routers (R) 122 as shown or 15 
other similar devices. 

Each monitored LAN segment 120 has a local commu- 
nication management unit 124 according to the present 
invention, of which two are shown. A central management 
unit 126 according to the present invention controls all local 20 
communication management units 124. In addition to cen- 
tralized database and control services, central management 
unit 126 can be used for the real-time monitoring and 
off-line restoration of audio and/or video communication 
sessions from a single point. Central management unit 126 25 
is optionally and preferably either a dedicated unit similar in 
structure to local communication management units 124 but 
without the storage capability, or central management unit 
126 is alternatively and preferably integrated with local 
communication management units 124 to provide the func- 30 
tionality of both local communication management unit 124 
and central management unit 126 in a single station. Local 
communication management units 124 are preferably either 
communication management units 13 substantially as 
described in FIGS. 1 and 2, or alternatively and preferably 35 
are simpler units which lack the capability to retrieve and 
display a communication session locally. 

In still another preferred embodiment of the present 
invention (not shown), multi-user operation based on Client/ 
Server architecture is preferably supported for basic system 40 
104 and zone system 116. An unlimited number of "Client" 
stations may be connected anywhere on the LAN, providing 
users with management and monitoring/retrieval capabilities 
determined by the authorization level of each specific user. 

It will be appreciated that the above descriptions are 45 
intended only to serve as examples, and that many other 
embodiments are possible within the spirit and the scope of 
the present invention. 

What is claimed is: 

1. A system for managing a computer network-based 50 
telephone session over a computer network, the computer 
network being divided into a plurality of segments, the 
system comprising: 

(a) a network connector for connecting to the computer 
network and for receiving data packets from a single 55 
segment of the computer network; 

(b) a filtering unit for filtering said data packets from said 
single segment and for accepting said data packets 
substantially only if said data packets contain data 
selected from the group consisting of audio data and 60 
video data, such that said data packets form at least a 
part of the computer network-based telephone session 
and such that said data packets are selected data pack- 
ets; 

(c) a management unit for receiving said selected data 65 
packets from said single segment and for storing said 
selected data packets, such that said selected data 
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packets are stored data packets, wherein said manage- 
ment unit and said filtering unit form a local manage- 
ment unit for said single segment of the computer 
network, said local management unit analyzing said 
selected data packets if the computer network-based 
telephone session occurs within said single segment; 

(d) a storage medium for receiving and storing said stored 
data packets from said local management unit, such 
that at least a portion of the computer network-based 
telephone session is stored; and 

(e) a central management unit for controlling each local 
management unit, said central management unit con- 
trolling storage in said storage medium and said central 
management unit analyzing said selected data packets 
from the computer network-based telephone session if 
the computer network-based telephone session includes 
data packets transmitted on a plurality of segments of 
the computer network. 

2. The system of claim 1, further comprising: 

(f) a data restore unit for retrieving and displaying said at 
least a portion of the computer network-based tele- 
phone session, said data restore unit requesting said 
data packets from said storage medium through said 
central management unit, and said data restore unit 
reconstructing said data packets for displaying said at 
least a portion of the computer network-based tele- 
phone session. 

3. The system of claim 2, wherein said data restore unit 
further comprises a communication session display unit for 
displaying at least a portion of the computer network-based 
telephone session. 

4. The system of claim 3, wherein said communication 
session display unit is selected from the group consisting of 
a video unit and an audio unit. 

5. The system of claim 2, further comprising: 

(g) a database connected to said filtering unit for storing 
filtering information, said filtering information includ- 
ing at least one IP address of a party whose computer 
network-based telephone sessions are monitored; 

wherein said filtering unit accepts said data packets accord- 
ing to said filtering information, such that said filtering unit 
substantially only accepts said data packets if said data 
packets fulfill said filtering information. 

6. The system of claim 5, further comprising: 

(g) a user computer for receiving at least one command of 
a user and for displaying information to said user, such 
that said user determines said filtering information 
according to said at least one command of said user. 

7. The system of claim 6, wherein the computer network 
is selected from the group consisting of a LAN (local area 
network) and a WAN (wide area network). 

8. The system of claim 7, wherein the computer network 
is a LAN (local area network). 

9. The system of claim 1, wherein said network connector 
is a network interface card. 

10. A method for storing at least a portion of a computer 
network-based telephone session performed on a computer 
network, the computer network-based telephone session 
being performed between a packet source and a packet 
destination, the steps of the method being performed by a 
data processor, the method comprising the steps of: 

(a) receiving a data packet from the packet source on the 
computer network; 

(b) analyzing said data packet to determine if said data 
packet is a computer network-based telephone session 
packet; 
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